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[57] ABSTRACT 

In a disk storage system having dual controllers and mir- 
rored memory therebetween, arbitration logic associated 
with each controller generates state transition signals to 
identify the mirrored memory access status for the controller 
generating the signal Each arbitration logic also monitors 
the state transition signals of the other. A failure in the 
mirrored memory system between the dual controllers is 
detected by one controller sensing an incorrect state transi- 
tion signal communicated from the other controller. A failure 
is also detected by one controller not sensing a state tran- 
sition signal from the other within a specified timeout 
period Memory refresh cycles are tapped to cause the 
arbitration logic to cycle through state transition signals 
thereby forcing each controller to attempt a mirrored 
memory access on a regular basis whereby a memory system 
failure may be detected. 

18 Claims, 4 Drawing Sheets 




05/03/2004, EAST Version: 1.4.1 



U.S. Patent Dec 16, 1997 Sheet 1 of 4 



5,699 




05/03/2004, EAST Version: 1.4.1 



U.S. Patent 



Dec. 16, 1997 



Sheet 2 of 4 



5,699,510 



FIG. 2 
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FIG. 3 
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FAILURE DETECTION SYSTEM FOR A controllers and mirrored memory, arbitration logic associ- 

MIRKORED MEMORY DUAL CONTROLLER ated with each controller generates state transition signals to 

DESK STORAGE SYSTEM identify a mirrored memory access status for the controller 

generating the signal. Each arbitration logic also monitors 

CROSS REFERENCE TO RELATED 5 the state transition signals of the other. A failure in the 
APPLICATION mirrored memory system between the dual controllers is 
This is a continuation of application Set No. 08/357,617 detected by one controller sensing an incorrect state transi- 
ted on Dec. 15, 1994, now abandoned. 11011 si S nal communicated from the other controller. A failure 

is also detected by one controller not sensing a state tran- 

FEBLD OF THE INVENTION w sition signal from the other within a specified timeout 

This invention relates, in general, to computer disk stor- penod. 

age controllers and, more particularly, to a system and According to further principles of the present invention, 

method for detecting controller failure in a mirrored memory memory refresh cycles are tapped to cause the arbitration 

multiple controller disk storage system. logic to cycle through state transition signals thereby forcing 

15 each controller to attempt a mirrored memory access on a 

BACKGROUND OF THE INVENTION regular basis whereby a memory system failure may be 

In high reliability computer disk storage systems, there is detected. Consequently, in cases where controller memory 

a desire to have redundancy in all the physical parts which access may not occur often, such as with a slave controller 

make up a subsystem to reduce the potential for loss of data « a master/slave context, memory system failures are 

and down time upon failure of a part The use of dual disk 20 detected earlier rather than later due to the constant arbitra- 

storage controllers, each having its own memory, provides tfcm between controllers for memory access at refresh, 

several major benefits to a disk storage system. For example, With the failure detection system and method of the 

(1) a redundancy of storage information is retained to allow present invention, controller and mirrored memory reliabil- 

for recovery in the case of failure or loss of one controller ity is increased. Other objects, advantages, and capabilities 

or its memory; (2) recovery from a disabled controller is 25 of the present invention wQl become more apparent as the 

feasible due to the failover capabilities of the secondary description proceeds, 
controller; and (3) greater system up time is achieved 

through the secondary controller being available. DESCRIPTION OF THE DRAWINGS 

With the desire for more performance out of these redun- ^ pjQ, x is a block diagram representing an overview of the 

dant subsystems, caching and the use of memory as tempo- present invention system for detecting controller failure in a 

rary storage has become commonplace. The means by which d ua i controller disk storage system having mirrored memory 

these duplicate physical memories are kept in synchroniza- therebetween. 

tion can be difficult Some disk systems use a latent (delayed nG 2 u % scbematic block of me present 

or massive update) process to create this duplication, but that 35 i nvcnt i on 

Z^^^^^ZT^faS^ffi HG. 3 is the schematic block diagram of FIG. 2 wherein 

omanage.Anotherapproach(meo Be u 5 edmttasmventon) UQidirectional ^ of co^^tion are depicted for 

is to form a real time mirrored memory process to create and uniiurccu«u<u F*"™ ^ " , v . , • 

retain accurate this duplication of data. The use of real time, dete f n « controUcT f f™ dunn S a «f« h ° f nar " 

synchronized, redundant memory (mirrored memory) in w rored memory accordrng to prmciples of the present mven- 

dual controllers can improve speed and accuracy in the case 11 ' 

of a failover from one controller to the other. FKJ. 4 is an arbitration logic state transition diagram 

However, this use of redundant memory makes the prob- reflating the memory access status states for each control- 

lem of providing multiple disk storage controller solutions ^ 

substantially more difficult Exemplary of the significant 43 DETAILED DESCRIPTION OF THE 

problems to overcome include how to effectively and reli- INVENTION 

ably (1) detect controller failure early on in the context of ^ 

mirr ored memory processing so as to reduce potential prob- FIG. 1 is a block diagram representing an overview of the 

lems that may occur from a later discovery of failure; (2) present invention system for detecting mirrored memory 

detect controller failure without significant hardware and/or 50 system controller failure in a dual controller disk storage 

software overhead requirements; and (3) detect controller system 10. Disk storage control system 10 includes disk 

failure to separate the controllers and discontinue mirroring storage subsystem 15 having disk storage devices 12 therein 

of their memories without loss of processing operations and and dual disk storage controllers 20 and 25. Controllers 20 

capabilities. and 25 each have memory 30 and 35, respectively. 

Given the foregoing problems associated with controller 55 Although most any type of Random Access Memory 

failure detection in a multiple controller disk storage system, (RAM) is suitable for use as memory 30 and 35, in the 

and other problems not addressed herein, it has not generally preferred embodiment a non-volatile RAM (or volatile 

been taught in the prior art to use mirrored memory between RAM made non-volatile by use of a power supply backup) 

controllers in a multiple controller system* is used to allow far retention of data in the event of a power 

Accordingly, objects of the present invention are to pro- 60 failure. Moreover, although only dual controllers 20 and 25 

vide an effective and reliable controller failure detection are shown in the diagram and discussed generally herein, it 

system for real time, synchronous, mirrored memory con- will be obvious that the principles expressed and implied 

trollers in a dual controller disk storage system. herein are likewise applicable in other multiple controller 

environments, ie., mare than two controllers. 

SUMMARY OF THE INVENTION a Each memory 30 and 35 is a mirrored memory. As is well 

According to principles of the present invention in its known in the art, mirrored memory simply means that data 
preferred embodiment, in a disk storage system having dual in one memory is duplicated or 4 'mirrored" in another 
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memory. As used in the present invention, mirrored memory Each DRAM controller 50 and 55 has its own internal 

means that data in the memory of one controller is dupli- clock (not shown) for governing its respective circuitry and 

cated or << niirrored" in the memory of the other controller. for purposes such as initiating a request for memory refresh. 

The existence of dual controllers, and mirrored memory Likewise, each arbitration logic 40 and 45 has its own 

in each, provides a fault tolerant environment for disk 5 internal clock whereby a response timeout may be detected 

storage system 10. Namely, in the event of a failure of one when state transition signals are communicated from one 

of the controllers, or one of the controller memory systems, arbitration logic to the other. As previously mentioned in 

the existence of the other controller and its mirrored memory reference to FIG. 1, arbitration logic 40 and 45 control which 

provides a seamless failover option far continued process- controller is granted access to the memories 30 and 55, and 

ing. In this context, communication occurs between control- 10 which controller is disabled from accessing the same. As 

lers 20 and 25 to provide a cost effective real time link and such, arbitration logic 40 and 45 communicate with each 

to allow each controller to monitor the state of the duplicate other via state transition signals and, respectively, commu- 

controller and to coordinate activities. nicate with certain local memory system control means, 

In the preferred embodiment, the mirrored memory is a including DRAM controllers 50 and 55, buffers 60 and 65, 

real time mirrored memory, Le., a single microprocessor or 15 control transceivers 70 and 75, and data transceivers 80 and 

direct memory access updates data into or retrieves data 85. 

from both memories 30 and 35 at substantially the same As common in the art, DRAM controllers 50 and 55 

time. Arbitration logic 40 and 45 controls when each con- manage and generate timing and control logic signals, such 

troller is granted access to update or retrieve data from the as Row Address Strobe (RAS), Column Address Strobe 

mirrored memory. Arbitration logic 40 and 45 communicate ^ (CAS), Write Enable (WE), Output Enable (OE), etc., for 

with each other so that each knows which controller has accessing appropriate addresses in DRAM 30 and 35, 

current access to the memories. Each arbitration logic gen- respectively. Buffers 60 and 65 are DRAM controller buffers 

crates state transition signals to identify a mirrored memory for enabling and/or disabling each DRAM controller 50 and 

access status for the controller generating the signal. Each 55 with respect to accessing DRAM 30 and 35, respectively, 

arbitration logic also monitors the state transition signals of 23 Control transceivers 70 and 75 are bi-directional trans- 

the other. Accordingly, a failure in the mirrored memory ceiver buffers for a local controller (i.e„ the controller on 

system between the dual controllers is detected by one which the transceiver resides) to (1) drive address signals to 

controller sensing an incorrect state transition signal com- a backplane 78 of the computer system to access the other 

municated from the other controller or by one controller not (remote) controller * s memory, or (2) receive address signals 

sensing a state transition signal from the other within a ^ from the remote controller through the backplane to access 

specified timeout period the local controller's memory. Likewise, data transceivers 

In the preferred embodiment, arbitration logic 40 and 45 80 and 85 are bi-directional transceiver buffers for a local 
also only allow one controller to access the memories at a controller to (1) drive data signals to the backplane 78 to 
single time. For example, when controller 20 is granted send to the remote controller, or (2) receive data signals from 
access to memory 30, it is likewise granted access to 35 the remote controller through the backplane, 
memory 35, and controller 25 is disallowed access to either Each DRAM controller 50 and 55 is configured to refresh 
memory. Arbitration logic 40 and 45 control simultaneous the memory (DRAM 30 and 35, respectively) at a refresh 
access by cornmunicating together to enable and/or disable interval determined by each DRAM controller's own in (in- 
appropriate signal lines in each controller. pendently executing clock timer. These memory refresh 

Given that one of the key purposes of a dual controller 40 cycles are used as a means to cause each arbitration logic to 
configuration is to allow for the capability of immediate cycle through state transition signals thereby forcing each 
failover from one controller to the other in the event of a controller to attempt a mirrored memory access, i.e., an 
failure of one of the controllers, it is imperative that the access to the memory residing on the local and remote 
memory contents of each controller be identical before a controller, on a reliably consistent basis whereby a memory 
controller failover occurs so that operation will continue 4s system failure may be detected. This system and method 
uninterrupted. Likewise, it is imperative that a controller affords reliability in any dual controller relationship, such as 
failure be detected early on in the processing scheme so that master/master (peer/peer) or master/slave. It is especially 
the mirroring of the memory can be disabled and the data valuable in a master/slave controller relationship because a 
integrity of the memory of at least the non-failing controller slave controller may not access the mirrored memory often 
remain reliable for continued system operation. 50 and, therefore, would not detect whether the remote con- 
Accordingly, the present invention focuses on early detec- troller has failed until a later potentially detrimental time, 
tion of a controller failure in a multiple controller configu- When a memory access cycle (read, write, or refresh) is 
ration by using, as a key element, arbitration logic 40 and 45 signaled to occur by a DRAM controller 50 or 55, that signal 
to communicate and control mirrored memory access status is communicated to its local arbitration logic 40 or 45. If that 
between controllers 20 and 25. 55 local controller does not currently have mirrored memory 

Referring now to FIG, 2, a more detailed schematic block access, the local arbitration logic communicates a state 
diagram of the present invention system is shown. Similar transition signal requesting mirrored memory access to the 
components between figures retain similar reference num- other (remote) controller. The state transition signal identi- 
bers. Accordingly, each controller 20 and 25 is referenced fies the mirrored memory access status of the (local) con- 
generally, each mirrored memory 30 and 35 is referenced as 60 troller cornmunicating the signal. For example, in this 
Non-Volatile Dynamic Random Access Memory instance, a state transition signal requesting memory access 
(NVDRAM) as used in the preferred embodimeut, and is communicated to the remote arbitration logic, 
arbitration logic 40 and 45 are likewise referenced as in FIG. Responsively, the remote controller that currently has mir- 
I. For simplicity purposes, NVDRAM controllers 50 and 55 rored memory access senses the requesting state transition 
will be referred to herein as DRAM controllers. All direc- 65 signal and replies with a responsive state transition signal for 
tioaal arrows indicate paths of communication and/or trans- granting the requesting controller access to the mirrored 
fer of data. memory. The responsive state transition signal occurs after 



05/03/2004, EAST Version: 1.4.1 



5,6S 

5 

the remote controller completes its own mirrored memory 
access if such is occurring when the request is received 

As soon as the local arbitration logic communicates the 
memory request, it initiates its own timer to clock a timeout 
period. If the remote controller does not respond within the 
predetermined interval of time, Le. f the timeout period, the 
local controller recognizes that a failure has occurred with 
the remote controller memory system 

A remote controller memory system failure is also 
detected upon the sensing by the local controller of an 
incorrect state transition signal communicated from the 
remote controller. For example, if the local controller is 
expecting to receive a state transition signal granting it 
access 4 to the mirrored memory but instead receives some 
other state transition signal from the remote controller, the 
local controller recognizes that a failure has occurred 

By way of these state transition signals and in conjunction 
with the timeout interval, each controller (1) communicates 
its own mirrored memory access status, (2) senses the status 
of the other controller, and/or (3) senses whether an appro- 
priate status signal is communicated Furthermore, memory 
refresh cycles are tapped to force arbitrary cycling through 
the state transition signals whereby mirrored memory is 
accessed on a regular basis to provide for a consistent and 
reliable means for failure detection in the memory system 

Operation of FIG. 2 is best demonstrated by the example 
as shown in FIG. 3. FIG. 3 is the same as FIG. 2 except that 
the bi-directional arrows of FIG. 2 are substituted in FIG. 3 
with uni-directional arrows depicting the actual directional 
paths of communication during a refresh of mirrored 
memory by controller 20. Although this depiction and dis- 
cussion associated therewith exemplifies the state transition 
signals generated by the arbitration logic during a memory 
refresh cycle, it is understood that such state transition 
signals also occur during other memory access transactions, 
such as a read or write. 

In the event that controller 20 initiates a request for 
memory refresh, DRAM controller 50 asserts a request 
signal to its own arbitration logic 40. If controller 20 does 
not already have access to the mirrored memory, arbitration 
logic 40 enters a Request state and communicates such state 
transition signal to arbitration logic 45 of controller 25. A 
Request state is when the local arbitration logic 40 (in this 
example) waits for the remote arbitration logic 45 to grant 
controller 20 access to remote DRAM 35. 

If DRAM controller 55 is accessing the mirrored memory 
when arbitration logic 45 senses the Request state transition 
signal as communicated from arbitration logic 40, then 
DRAM controller 55 will complete its cycle for using the 
memory (either for reading, writing, or refresh) and remove 
its own Request to arbitration logic 45. Arbitration logic 45 
then communicates a state transition signal granting memory 
access to arbitration logic 40 and, subsequently, enters into 
a Slave state. Upon entering the Slave state, arbitration logic 
45 disables DRAM controller buffer 65 (as shown by the 
depiction that no directional arrow proceeds out from, Le., 
points away from, buffer 65). Arbitration logic 45 also sets 
control transceivers 75 to drive address signals from back- 
plane 78 to DRAM 35 (as shown by directional arrows 73 
and 77). 

Arbitration logic 40 acknowledges this by entering into a 
Master state wherein controller 20 is allowed access to both 
memories 30 and 35. Arbitration logic 40 enables its local 
DRAM controller buffer 60 (as shown by directional arrow 
62), and sets control transceivers 70 to drive from controller 
20 to backplane 78 (as shown by directional arrow 73). 
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Next, DRAM controller 50 performs a DRAM refresh 
cycle by asserting CAS and RAS to access its own DRAM 
30 (as shown by directional arrow 64) and by asserting the 
same through control transceivers 70 and 75 to access 

5 DRAM 35 of controller 20 (as shown by directional arrows 
66, 73 and 77). Consequently, DRAM 30 and 35 are 
refreshed substantially simultaneously. 

Referring now to FIG. 4, an arbitration logic state tran- 
sition diagram is depicted reflecting the memory access 

10 status states for each controller in a master/slave relation- 
ship. As previously discussed, arbitration logic 40 and 45 
(FIGS. 1-3) control operation of the mirroring of the memo- 
ries 30 and 35 through communication and sensing of state 
transition signals. The arbitration logic also controls the 

15 output enables and direction selection of all buffers and 
transceivers connected to the memory system As such, only 
one controller is granted the ability to access both the local 
and remote banks of DRAM at a single time. The other 
controller cannot access either memory nnul the arbitration 

20 logic cycles through appropriate transition states at such 
times as during a memory refresh cycle or some other 
read/write operation. As the arbitration logic transitions 
through its various states, it sends its current state to the 
remote controller and, likewise, monitors the state transition 

25 signals of the remote arbitration logic. This allows either set 
of logic to detect a fault in the other. 

It is understood that a variety of transition states may exist 
and not all transition states are shown in the depiction of 
FIG. 4. However, some of the various states as used in the 

30 preferred embodiment and shown in FIG. 4 are described as 
follows: 

RESET: While the reset line is asserted on the controller 
board, the arbitration logic remains in the Reset state, 90. In 
this state the local control and data backplane transceivers 
(70, 75, 80, and 85 of FIG. 1) are disabled as is the local 
DRAM controller (50 and 55). Once reset is released the 
arbitration logic enters the Slave state. 
SLAVE: While in the Slave state, 95, the local control 

43 backplane transceivers are pointed at the local DRAM, and 
the local DRAM controller buffer (60 or 65) is disabled The 
local data backplane transceivers are set according to the 
operation being performed (read or write). When a request 
for memory access from the local DRAM controller is 

45 received by the local arbitration logic, the local arbitration 
logic enters the Request state to be able to access the 
memories. 

REQUEST: The local arbitration logic timer is started 
when the Request state 100 is first entered While in this 

SO state, the Request state transition signal is communicated to 
the remote arbitration logic, and the local arbitration logic 
waits for the remote arbitration logic to grant the local 
controller access to the remote DRAM The local backplane 
transceivers and DRAM controller are set the same way as 

ss in the Slave state. If the timer signals a timeout interval 
before access to the remote DRAM is granted by the remote 
arbitration logic, the local arbitration logic enters the Failed 
state. If access is granted, the local arbitration logic enters 
the Master state. 

60 MASTER: When in the Master state, 105, access is 
granted to both banks of DRAM, 30 and 35. The local 
control backplane transceivers are pointed toward the 
remote board and the local DRAM controller buffer (60 or 
65) is enabled The data backplane transceivers are set 

65 according to the operation being performed (read or write). 
The arbitration logic remains in this state until a Request 
from the remote board is detected and the request line from 
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the local DRAM controller is de- asserted. This state is (c) means for timing a predetermined interval of time in 

entered after the remote controller has entered the Slave ( connection with and beginning concurrently with the 

state. communication of the first state transition signal from 

GRANT: The local arbitration logic enters the Grant state the first controller to the second controller; and, 

110 when it detects that the remote controller is requesting 5 (d) means for sensing one of: 

the mirror interface. The local arbitration logic will wait in (i) a second state transition signal communicated from 

this state until the local DRAM controller has finished its the second controller to the first controller in 

current memory access and de-asserted its request line. response to the first state transition signal, wherein 

FAILED: The Failed state 115 is entered when (1) the bus the second state transition signal identifies a valid 

is not granted wi thin the timeout period as monitored by the 10 mirrored memory access status or a failure of the 

clock in the local arbitration logic, or (2) an illegal transition second controller; and, 

state is detected on the remote controller. The arbitration (ii) a completion of the interval of time indicative of a 
logic remains in this state until the local controller is reset, failure of the second controller, 
after which the Reset state is entered, or the remote arbitra- 2. The failure detection system of claim 1 wherein the first 
tion logic enters the Reset state, after which the Resynch 15 state transition signal is a signal indicative of a request for 
state is entered. While in this state both backplane trans- access to the mirrored memory of each controller, 
ceivers are disabled and the DRAM controller buffer is 3. The failure detection system of claim 1 further corn- 
enabled, prising means for communicating the first state transition 

RESYNCH: The Resynch state 120 is entered any time rt si g Qal u P° n cvent of a memory access cycle, 

the local arbitration logic detects that the remote arbitration 20 4 - ^ failurc detection system of claim I wherein the 

logic has entered the Reset state. A timer is started whenever second state transition signal is a signal indicative of a 

this state is entered. The arbitration logic wm remain in this granting of access to the mirrored memory to the first 

state until the remote arbitration logic leaves the Reset state controller, and whereby the second controller is denied 

or the timeout interval completes. If the timeout interval acccss to thc mirrored memory. 

completes, the Failed state is entered. The Slave state is 25 5 - ™e failure detection system of claim 1 wherein the 

entered if the remote controller leaves the Reset state before second state transition signal is an incorrect state transition 

the timeout interval completes. While in this state both signal rcktive to what the nwtcontioUere^cts in resr>onse 

backplane transceivers are disabled and the DRAM control- t0 Ac statc transition signal communicated, whereby 

ler buffer is enabled. failure of the second controller is detected by the first 

SINGLE: The Single statc 125 is entered any time the 30 controller due to the incorrect state transition rignal. 

presence of a second* controller is not detected" or if the * ™°*f™ ° f T 

controllers are to remain in an 'Isolation mode", Le., a sccon * stat * T*?T £Z?LZ »TTTL^Z£« 

non-memory mirroring state. Tne arbitration logic remains second confer to the first c<>ntroUer upon sensing me first 

in this state as long as one of these two conditions exists or „ H?/ 1 ™!? 11 ^^f* „ , . , . . . . 

„ . r < ^ . - o11 MtfMm _ Dooof « 7. The failure detection system of claim 1 wherein the 

a controller reset is detected. In all cases, a Reset state will A _ ... . . . , ' . _^ , , 

. A . :« 4u;« c*«*~ uJL *^«c state transition signals include signals indicative of a local 

be the next state. While in this statc, both backplane trans- . „ m * 0 x^ lp ^^^^ ^ 

ceivers are disabled and the DRAM controller buffer is controUer memory access status, selected from the group 

enabled. consisting of: 

What has been described above are the preferred embodi- ^ « » J***> whcrdn acccss to ^ mcmor y * 

ments for a system and method for detecting controller disallowed; 

failure in a dual controller disk storage system having (*>) requesting access to the memory; 

mirrored memory therebetween. It is clear that the present (c) being a master, wherein access to the memory is 

invention offers a powerful tool for providing a cost allowed; 

effective, real time link between controllers, and allows each 45 granting memory access to a remote controller; 

controller to monitor the state of the other, and aUowseach ( } ^ ^ granted acccss to the memory by a 

controllers' activities to be coordinated for failure detection. v remote controller 

Moreover, it will be obvious to one of ordinary skill in the . * 

art that the present invention is easily implemented utilizing W ^wetting lts orouitry; 

any of a variety of hardware and software tools existing in 50 (g) ^synchronizing its circuitry with a remote controller; 

the art While the present invention has been described by and, 

reference to specific embodiments, it will be obvious that (h) isolating communication from a remote controller, 

other alternative embodiments and methods of implemen- 8. The failure detection system of claim 1 further includ- 

tation or modification may be employed without departing ing control means on each controller for controlling access 

from the true spirit and scope of the invention. 55 to the mirrored memory of the controller on which the 

What is claimed is: control means resides, and wherein the control is based on 

1. A failure detection system for a computer disk storage the state transition signals generated, 

control system having a plurality of controllers, comprising: 9. The failure detection system of claim 8 wherein the 

(a) real-time mirrored memory on each controller with control means includes a memory controller, buffers, and 
respect to each other controller, 60 transceivers for enabling, disabling, and selecting flow 

(b) means for communicating a first state transition signal direction of memory address and data signals. 

by a first controller of the plurality of controllers to a A method of detecting a memory system failure in a 

second controller of the plurality of controllers at least computer disk storage control system having first and sec- 

upon each event of a memory refresh cycle of the first ond disk controllers and real-time mirrored memory 

controUer, wherein the first state transition signal iden- 65 therebetween, comprising the steps of: 

tifies a mirrored memory access status of the first (a) the first controller communicating a first state transi- 

coDtroUer; tion signal to the second controller at least upon each 
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event of a memoiy refresh cycle of the first controller, 
wherein the first state transition signal identifies a 
mirrored memory access status of the first controller; 

(b) the first controller starting a timer concurrently with 
the communication of the first state transition signal far 
timing a predetermined interval of time; and, 

(c) the first controller sensing one of: 

(i) a second state transition signal communicated from 
the second controller to the first controller in 
response to the first state transition signal, wherein 
the second state transition signal identifies a valid 
mirrored memory access status or a failure of the 
second controller; and, 

(ii) a completion of the interval of time indicative of a 
failure of the second controller memory system. 

11. The method according to claim 10 wherein the first 
state transition signal indicates a request for access to the 
mirrored memory. 

12. The method according to claim 10 wherein the first 
state transition signal is communicated upon an event of a 
memory access cycle. 

13. The method according to claim 10 wherein the second 
state transition signal grants access to the mirrored memory 
to the first controller, and whereby the second controller is 
denied access to the mirrored memory. 

14. The method according to claim 10 wherein the second 
state transition signal is an incorrect state transition signal 
relative to what the first controller expects in response to the 
first state transition signal communicated, whereby failure of 
the second controller memory system is detected by the first 
controller due to the incorrect state transition signaL 
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15. The method according to claim 10 wherein the second 
state transition signal is communicated upon sensing the first 
state transition signal. 

16. The method according to claim 10 wherein the state 
transition signals include signals indicative of a local con- 
troller memory access status, selected from the group con- 
sisting of: 

(a) being a slave, wherein access to the memory is 
disallowed; 

(b) requesting access to the memory; 

(c) being a master, wherein access to the memory is 
allowed; 

(d) granting memory access to a remote controller; 

(e) failing to being granted access to the memory by a 
remote controller; 

(f) resetting its circuitry; 

(g) resynchronizing its circuitry with a remote controller; 
and, 

(h) isolating communication from a remote controller. 

17. The method according to claim 10 further including 
the step of controlling access to the mirrored memory by the 
controller on which the memory resides based on the state 
transition signals generated. 

18. The method according to claim 17 wherein the step of 
controlling access includes signaling a memory controller, 
buffers, and transceivers far enabling, disabling, and select- 
ing flow direction of memory address and data signals. 
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